Database: National Security Vetting Failures

Shihab Ahmed Shihab Shihab is a citizen and national of Iraq. He entered the United States in September 2020 on a B1/B2 tourist visitor visa and then promptly filed an asylum claim with USCIS before the visitor visa had expired. But according to a later FBI terrorism investigation and prosecution documents, the State Department approved this visitor visa despite Shihab’s long experience as an al Qaeda fighter who specialized in killing U.S. soldiers during the U.S. war there, as well as his purported past imprisonments by the American military and the Iraqi government.

Within seven months of settling in the Columbus, Ohio, area on the visitor’s visa (April 2021), an undercover government informant reported that Shihab was willing to help a fictitious brother of the informant illegally enter the United States through the Southern border even though Shihab was told that European officials had denied entry to the brother on grounds of his membership in ISIS.

This scheme soon led to an FBI terrorism investigation and discovery that Shihab was already well enmeshed in a global conspiracy with an overseas terrorist group fighting unit associated with the Islamic State of Iraq and Syria (ISIS) to smuggle them into the United States over the southern border for the purpose of assassinating former President George W. Bush as revenge for the 2003 Operation Iraqi Freedom, court records assert. During the investigation, Shihab disclosed to the informants that he had already arranged the smuggling of three people from Iraq into the United States over the border, including an agent of the designated terrorist group Hizballah.

The alleged conspiracy to murder former President Bush involved Shihab arranging to smuggle four fighters in his old unit, “al Raed”, into Brazil and then over the Southern border, including two former Iraqi intelligence agents and one who served as the secretary of an ISIS financial minister, as well as potentially more members of ISIS and al Raed.

At issue in the vetting of Shihab for his initial visitor’s visa is the fact that, in relaying the plan to the informant, Shihab disclosed that he had killed many Americans in Iraq between 2003 and 2006 while fighting with the ISIS predecessor group known as al Qaeda in Iraq (AQI). For example, Shihab told informants he’d transported vehicles and weapons from Syria into Iraq and supplied explosives inside them to AQI. But he also disclosed that American, Iraqi, Syrian, and Jordanian authorities had arrested him at various times during his war years, which if true, means that database checks or interviews with family or friends during the visitor visa process should have picked up his disqualifying history.

Security vetting for Shihab’s asylum claim would be moot because, by the time of his interview with USCIS adjudicators, the FBI was deeply involved in its undercover investigation.

It should be acknowledged here that court filings and other public information do not disclose whether his past claimed detentions by American, Iraqi, and Jordanian authorities actually happened. But the claims likely are rooted in truth because the investigation did show that Shihab was in fact affiliated enough with al Raed, as a trusted former member, that he was in actual contact with real current members and the group’s real new leader in Qatar. Shihab’s long association with al Raed and his combat against American troops should have registered in classified databases.

Shihab and the al Raed members, working through a new al Raed leader based in Qatar, planned to create a vehicle bomb for use in the attack on Bush in Dallas, Texas, an FBI complaint stated, and also “that he wanted to be involved in the actual attack and assassination of former president Bush and did not care if he died as he would be proud to have been involved in killing former president Bush.” He budgeted about $3 million in ISIS money for the operation that would be made available by the ISIS finance officer. His role was to facilitate the cross-border smuggling, then conduct surveillance and acquire the necessary weapons and explosives, and he actually traveled to Dallas to conduct surveillance.

By this time, however, the FBI informants had fully penetrated the scheme, and the FBI arrested him in May 2022. By March 2023, Shihab had agreed to plead guilty to an information charge of attempted material support for terrorism.

British national Malik Faisal Akram, entered the United States in accordance with fast-track visa waiver travel requirements between Great Britain and 40 countries and the United States, which allow tens of millions of travelers per year to visit for up to 90 days without a visa.

After registering through the Electronic System for Travel Authorization system (ESTA), which requires that travelers pass a background check and “establish their eligibility”, Akram flew to New York City on December 29, 2021, and then on to Dallas, Texas, two days later. U.S. Customs and Border Protection inspectors at the John F. Kennedy International Airport in New York City let him pass through. The system, administered by CBP, did not catch prior criminal history and terrorism-related intelligence information held by the British, which is closely allied with the United States on intelligence-sharing matters.

As a result, once in Texas, Akram was free to buy a handgun, stay in homeless shelters for a week plotting, and then to attack a Colleyville, Texas, synagogue during Shabbat services.

At gunpoint and claiming he had explosives, Akram took the rabbi and three congregants hostage for 11 hours, threatening to kill them on behalf of a foreign terrorist organization to secure the release of convicted terrorist and MIT neuroscientist Aafia Siddiqui, known in counterterrorism circles as “Lady al Qaeda”, who had been serving an 86-year sentence at Carswell Air Force Base prison near Fort Worth. She was in prison on a 2010 conviction of assaulting and attempting to murder U.S. soldiers sent to interrogate her in 2008 in Pakistan. During the standoff, Akram ranted on a Facebook livestream about her imprisonment in Texas.

Akram let some hostages go, but the rabbi attacked him with a chair, allowing FBI agents to shoot him to death. President Joe Biden dubbed the attack an act of terrorism.

Akram’s brother disclosed that Akram, 44 at the time, had been known to the UK’s MI5 domestic intelligence agency in the second half of 2020 for possible involvement in Islamist terrorism. British officials had placed Akram on a watch list in 2020, but later decided he no longer posed a threat and removed him. He also had a criminal history for drugs and violent behavior dating to when he was 19 on to later convictions on theft and harassment charges.

The ESTA system checks for criminal history records strictly by paper and database, using biographical information provided by travelers, who could lie on the electronic forms.

But his criminal convictions and jail sentence crimes involving drugs and, once, a “violent disorder” when Akram was 19, never flagged U.S. authorities during the quick online visa waiver application process between the two nations, NBC News reported. Neither did intelligence information about his predilection for Islamist violence. He served one spell behind bars when an imam reported him for “concerning behavior” and disrupting Friday night prayer services. He was once banned from a British court in 2001 for praising the 9/11 attacks and was a frequent visitor to Pakistan, with connections to the controversial Islamic sect Tablighi Jamaat. After a 2012 conviction for theft, Akram reportedly conducted himself in an “extreme” manner when attending the jail’s mosque, and one observer noted he was “obsessed with Islam”, a Fox News report found.

According to The Spectator, he was twice referred to the Counter Terrorism Prevent program, as recently as 2019, which screens people thought to be at risk of being drawn into ideological violence, the newspaper reported.

“That’s one hell of a breadcrumb trail,” the media outlet concluded. “It seems incredible that with this number of concerns, Akram could simply step on a plane, presumably lie on his entry forms, and set off for the U.S. completely unimpeded. Two sets of borders were breached and the result was a terrifying ten-hour ordeal for innocent worshippers before his deranged antics were terminated with extreme prejudice.”

One reason the terrorism information may not have been shared in a lasting or permeable way with American agencies is because the British removed

Akram from their watch list, so he may never have been on any U.S. government watch list. Not long after the 2021 incident, the U.S. Department of Homeland Security opened a probe into how Akram defeated the visa waiver security vetting systems. The results of the probe were not publicly available as of March 2023, however. It is possible that improvements were since implemented that remain publicly unknown.

Singaporean national Jun Wei Yeo, who also used the name Dickson Yeo, entered the United States in January 2019 and was a George Washington University fellow until July 2019. The FBI arrested him in November 2019 on suspicion of espionage-related activity.

Neither court records nor open sources specify a visa or full range of dates during which Yeo was a GWU fellow in the Washington, D.C., area. However, for a university fellowship, he would have been required to have obtained either a J-1 cultural exchange visa or an F-1 student visa, either of which would have entailed State Department national security vetting in his native Singapore before he received a visa.

An eventual FBI counterintelligence investigation discovered that Yeo had been working clandestinely as a People’s Republic of China Intelligence Services (PRCIS) spy since at least 2015, several years before the university fellowship was approved. His mission was “to obtain valuable nonpublic information from the United States about matters of economic, military, and political importance, and then provide that information to his PRCIS handlers”, court records from his 2019 prosecution state. That included classified information if Yeo could obtain it. Yeo had been recruited by Chinese intelligence officers during a 2015 trip as a PhD student and accepted the mission out of anti-American fervor and greed, prosecutors alleged.

“Yeo, a highly educated Ph.D. candidate, understood that his work on behalf of the PRCIS contributed to a much larger effort to diminish American power and influence relative to China,” prosecutors argued in a sentencing memorandum. After his 2019 arrest for acting as an unregistered foreign agent, “Yeo conceded that he was motivated to work for the PRCIS, in part, because he was ideologically aligned with China’s goal of diminishing U.S. influence in international affairs.”

While security vetting for J and F visas in 2018 and 2019 was not geared toward discovering foreign spies trained in the art of evasion, State Department efforts in Singapore apparently missed at least one opportunity to do so.

Starting in 2018, before he became a GWU fellow, Yeo used the business social media platform LinkedIn to lure American job applicants who held security clearances to his “consulting company”. But the company he listed for his social media account did not actually exist. For his fake consulting company, Yeo used the same name as a prominent U.S. consulting firm that conducts public and government relations, a ruse that potentially could have been discovered had State Department personnel checked public records and called for an employment check during the visa vetting process.

Another potentially discoverable red flag was that Yeo’s PhD supervisor had been a high profile academic named Huang Jing. In 2017, two years before his student secured the George Washington University fellowship, Singapore expelled Jing from the country for being an “agent of influence of a foreign country” that was not identified in public reporting, according to the BBC. Any publicly available linkage between Jing and Yeo should have been discovered and pursued.

Instead, Yeo went on to use his fellowship time to collect hundreds of resumes from U.S. military and government personnel with security clearances, and he passed some of these resumes to Chinese intelligence operatives. In addition, he used his time at GWU to network with lobbyists and defense contracting companies. He was arrested in the United States in November 2019 and later sentenced to 14 months imprisonment. He returned to Singapore in December 2020 and was arrested there.

Congolese national Kaseba Katambwa, an ethnic Rwandan, illegally immigrated to the United Kingdom in 1996 on fraudulent identity documents belonging to a dead cousin. In 2009, the British criminal justice system convicted Katambwa of four times raping a 14-year-old girl and sentenced him to serve four terms of 13 years each, concurrently, for a total of 49 years. He also was convicted, in separate related cases, of drunken driving and criminal schemes to acquire property. He gained early prison release in 2017 for unknown reasons and filed an asylum claim in the UK to forestall deportation back to Congo, according to a U.S. sentencing memorandum filed as part of his defense later.

It was denied, and British immigration deported him to Congo. In about March 2018, he flew under a false name and date of birth on a temporary visitor's work visa related to a "non-profit" he created and then filed a U.S. asylum claim, according to defense and government sentencing memoranda in his later U.S. immigration fraud case. After the 90-day visitor's visa expired, in June 2018, he applied for asylum in Bridgeport, Conn., under the same fraudulent identity.

The investigating ICE agent's complaint notes that Katambwa provided fingerprints for this earlier visa. The USCIS visa adjudicator, however, apparently never cross-checked the print in shared databases that would have included the UK, perhaps because Katambwa was not coming directly from the UK and attested that he had been living in Congo continuously since 1969. Still, a cursory database run would have uncovered the fraud at this point.

The U.S. and the UK share sex offender and criminal history databases for immigration security purposes, and by 2018, fingerprint checks in asylum claims were required.

Later, during the investigation, the ICE agent did so and immediately found the match in the UK's shared sex offender database.

A second missed opportunity came and went when a USCIS adjudicator in New Jersey approved Katambwa's asylum application just three months later, in September 2018, under a pressure campaign put on by a Congolese expatriate community in Connecticut. By 2018, fingerprint checks for asylum claimants were required.

But it never happened.

All of his claims were accepted at face value in the absence of a fingerprint check or investigation into his "non-profit". Had the prints been run against all databases, authorities with USCIS would have quickly discovered the false name and birth date, fake persecution story, that he had been living in security for decades in the UK and no Congo, and that he had been convicted of child rape and other criminality.

These two USCIS security vetting failures allowed a convicted serial rapist convicted of fraud elsewhere into the United States. It was an ICE’s Homeland Security Investigation inquiry that discovered the fingerprints matched the rapist convict’s fingerprints in the UK. HSI arrested Katambwa in February 2019 on immigration fraud charges. A judge sentenced him to nine months in prison.

Chinese national Yanqing Ye applied for a J-1 cultural exchange visa in August 2017 and had one a month later when she entered the United States and joined Boston University’s Department of Physics, Chemistry, and Biomedical Engineering. On the application, Ye identified herself as a “student” and indicated that she had never been a member of any military.

But according to a later 2019 federal indictment stemming from an FBI counter-espionage investigation, Ye was a lieutenant of China’s People’s Liberation Army (PLA) and active with China’s top military academy, the National University of Defense Technology (NUDT), which is directed by the Chinese Community Party of which Ye also was a member.

While ostensibly “studying” at Boston University from October 2017 to April 2019, Ye worked at the direction of PLA officers assessing U.S. military websites and sending U.S. documents and information back to China. The FBI later found that, at the direction of one NUDT professor, who was a PLA colonel, Ye had accessed U.S. military websites, researched U.S. military projects, and compiled information for the PLA on two U.S. scientists with expertise in robotics and computer science. Furthermore, a review of a WeChat conversation revealed that Ye and the other PLA official from NUDT were collaborating on a research paper about a risk assessment model designed to decipher data for military applications.

American State Department officers responsible for her security vetting background check in August 2017, had they mounted a robust investigation, likely would have found evidence of her active-duty military service and association with key, high-ranking NUDT professors, perhaps in publicly available information on the internet about the joint research paper at NUDT, or a check of U.S. intelligence sources about Chinese military personnel, or merely during more penetrating interviews with Ye like one the FBI conducted with her.

In one such FBI interview at Logan International Airport, Ye admitted she held the rank of lieutenant in the PLA and that she was a member of the CCP. Ye apparently was a fugitive as of March 2023. The FBI was unable to arrest Ye after she was indicted for acting as an unregistered agent of a foreign government, visa fraud, false statements, and conspiracy. The FBI posted a Wanted poster for Ye based on an unfulfilled January 2020 arrest warrant.

Mohammed Saeed Alshamrani was a 21-year-old Saudi Royal Air Force 2nd lieutenant training with other Saudi pilots at the U.S. Naval Air Station in Pensacola, Fla., on December 6, 2019, when he opened fire on American soldiers, killing three, in a jihad-inspired terror attack supported by several other of the Saudi students. Local sheriff’s deputies who responded shot Saeed dead, ending the attack. According to a Daily Mail report, the U.S. embassy in Riyadh issued Alshamrani an A-2 diplomatic visa, and he arrived in Pensacola for military training in August 2017.

Alshamrani was among an estimated 5,000 foreign military trainees in the country training at the time on A-2 diplomatic visas, Saudis making up the majority of them. According to a Military.com story, Saeed and all other foreign military trainees cleared security screenings for the A-2 diplomatic visa, first by their own countries and then by a three-level screening process by U.S. embassies in the host nations. The applicants for training alongside U.S. troops would have their names run through databases maintained by the Departments of Defense, State, and Homeland Security to check for criminal activity or substance abuse. The trainees would also have to submit to a physical and psychological examination by a doctor approved by the U.S. embassy and then pass requirements for a visa from the State Department, officials told the media after the attack.

But the security screenings evidently still missed publicly available and potentially discoverable evidence that in 2015 Alshamrani controlled a Twitter account on which he often posted his interest in jihadiist videos, literature, and well-known extremist Saudi clerics Abdulaziz al-Turaifi and Ibrahim al-Sakran, Kuwaiti Hakim al-Mutairi, and Jordanian Eyad Qunaibi. A Saudi government analysis obtained by the Washington Post showed that Alshamrani posted anti-American screeds calling the country "evil" and that, prior to the attack, he hosted a dinner party in which his guests were entertained with video clips of previous mass terror attacks. Several of his fellow Saudi trainees called in sick the morning of the attack. All were sent back to Saudi Arabia afterward, their visas revoked.

Pakistani national Muhammad Masood, a licensed medical doctor in Pakistan, was able to obtain an H-1B skilled worker visa in February 2018 to work as a research coordinator for the Mayo Clinic in Rochester, Minn. In this case, it’s not entirely clear that State Department officers in Pakistan responsible for vetting local Pakistani applicants for U.S. visas could have discovered Masood’s mindset. But it seems more likely than not that the 28-year-old medical doctor was already radicalized and held violent extremist views, judging by the extent of his commitment to violent jihad he was observed espousing within 24 months of his arrival at the Mayo Clinic.

Perhaps because he was a doctor, U.S. State Department consular officers in Pakistan did not investigate deeply. But by at least January 2020, when an FBI counterterrorism investigation started, Masood was already deeply enmeshed in a circle of foreign jihadists with whom he frequently communicated online. To them, he explained that he had regarded his visa and Mayo Clinic job as having enabled him to get “behind enemy lines“ where “not many people can’t [sic] even reach here to attack”. Between January 2020 and March 2020, the FBI found, Masood was pledging his allegiance to the Islamic State and its leader online. He expressed his desire to travel to Syria to fight for ISIS or, failing that, to conduct “lone wolf” terrorist attacks in the United States. Some of those with whom Masood communicated were FBI informants.

“I want to kill and get killed...and kill and get killed … and again and again. This is what … Allah wished,” he told one.

Masood followed through on his words with deeds.

On Feb. 21, 2020, Masood purchased a plane ticket from Chicago, Ill., to Amman, Jordan, and from there planned to travel to Syria. On March 16, 2020, Masood’s travel plans changed because Jordan closed its borders to incoming travel due to the Coronavirus pandemic. Masood made a new plan to fly from Minneapolis to Los Angeles to meet up with an individual who he believed would assist him with travel via cargo ship to deliver him to ISIS territory.

On March 19, 2020, Masood traveled from Rochester to Minneapolis-St. Paul International Airport (MSP) to board a flight bound for Los Angeles, Calif. Upon arrival at MSP, Masood checked in for his flight and was subsequently arrested by the FBI’s Joint Terrorism Task Force. Masood was charged with attempting to provide material support to a designated foreign terrorist organization.

In August 2022, Masood pleaded guilty to attempting to provide material support for ISIS, a terrorist organization.

State Department adjudicators in Pakistan would not likely have approved an H-1B visa for Masood had they detected, perhaps through penetrating interviews with Masood or relatives or by reviewing his social media accounts, his apparent predilection for violent jihad or associations with violent jihadists. Denial of the visa at the application stage undoubtedly would have preempted the threat Masood posed to the American public.

While living in Jordan, the Syria-born Mustafa Alowemer applied for and received U.S. refugee status when he was 17. In August 2016, Alowemer entered the United States and settled in Pittsburgh, Pa.

But undiscovered by U.S. Citizenship and Immigration Services security vetting in Jordan was the fact that Alowemer apparently consorted with Islamist “mujahadeen”, and Jordanian authorities had detained him three times for doing so.

FBI investigation much later inside the United States turned up communications that Alowemer at the time believed were private with active-duty ISIS operatives fighting in the war zone. In one of these conversations, Alowemer boasted:

“I was raised in Jordan on loving the Jihad and the Mujahdeen [sic]. I met some Jordanian brothers, some of which did the Nafir [traveling to conduct jihad] in Raqqah [the self-proclaimed capital of the ISIS caliphate], and I, alongside some brothers, were [sic] arrested three times in Jordan, because I was one of the supporters.”

Instead of a potential denial that would have left him in Jordan, Alowemer received refugee status and allegedly went on three years later to plot what he believed was going to be a bombing of the Legacy International Worship Center church in Pittsburgh. The FBI had answered his call for help and set up a sting operation. Alowemer thought he was plotting online and in person with fellow ISIS sympathizers and bought six boxes of nails for shrapnel in a bomb he was going to hide in a backpack and detonate by remote control. Investigators said he wanted to hide a second bomb, timed to go off just as Pittsburgh police and first responders arrived at the scene.

In the FBI’s criminal complaint, Alowemer is quoted as saying, "After two hours, three hours when the police want to come – then when they've all come together. They'll have to lock down the whole of Pittsburgh."

The complaint said that Alowemer wanted to leave an ISIS flag to claim credit and a sign saying, "We've arrived."

Prosecutors charged Alowemer with providing material support to a terrorist organization and disseminating bomb-making instructions. He was proclaiming his innocence as of August 2021, when the prosecution was still in progress.

Russian national Maria Butina obtained an F-1 student visa in August 2016 to pursue graduate studies at American University in Washington, D.C.

But a much later FBI counterintelligence investigation learned what State Department security screeners for the F-1 visa apparently overlooked: Since at least 2015 and possibly as early as 2013, Butina worked as special assistant to a ranking Russian politician close to the Kremlin and presumably connected to Russian intelligence. He was identified in court papers only as “the Russian Official”, but in media reports as Alexander Torshin. Torshin was a well-known and politically connected public figure who parlayed his position as a legislator in the Russian Federation to appointment as a top official of the Russian Central Bank, with presumable links to federation intelligence services.

Hints were publicly available beyond Butina’s work relationship with Torshin. For instance, prior to obtaining the August 2016 student visa, Butina demonstrated her Kremlin connections in December 2015 when she arranged meetings between National Rifle Association officials and “high-level Russian officials” organized by Torshin, an identifiable hallmark of an influence operation. Screeners might also have explored Butina’s own political dedication to Vladimir Putin’s Kremlin and raised questions about it. As a college student, Butina had been politically active in the youth wing of Vladimir Putin’s United Russia Party, the BBC later reported. While studying political and educational science at the Altai State University in her Siberian home town of Barnaul, Butina was politically engaged and active in the university debating society, where her views could have been plumbed.

State Department visa vetting for the F-1 likely did not uncover Butina’s work relationship with Torshin, her devotion to Putin’s Kremlin, her involvement in arranging meetings with the NRA in Russia before getting her student visa, and her early political activism. Any of this reasonably would have led to a visa-approval delay for further counterintelligence investigation or a denial. An earlier counterintelligence investigation could have short-circuited further damage from Butina’s and Torshin’s continuation of political influence operations in Washington, D.C., after she received the visa, activities that targeted conservative American political circles close to the White House. Instead, Butina’s case only came to light amid later scandals over Russian efforts to influence the 2016 election, according to the Washington Post.

With the F-1 visa placing her in Washington, D.C., Butina and Torshin built social networks in Washington among conservative U.S. lawmakers and other conservative Americans with presumed influence at the White House. She more fully penetrated the National Rifle Association as part of the Torshin-directed operation.

Federal prosecutors in the case alleged that Butina’s work – illegal mainly because she did not register with the U.S. Department of Justice as a foreign agent – served the Russian strategy of creating political wedges within the American population, thus undermining and weakening American democracy, shaping public opinion for that purpose, and furthering Russian interests at the expense of the United States, prosecutors later alleged.

“Penetrating the U.S. national decision-making apparatus and the Intelligence Community are primary objectives for numerous foreign intelligence entities, including Russia,” a probable cause complaint stated. “The objective of the Russian Federation leadership is to expand its sphere of influence and strength, and it targets the United States and U.S. allies to further that goal.”

The complaint further explained that “Russian influence operations are a threat to U.S. interests as they are low-cost, relatively low-risk, and deniable ways to shape foreign perceptions and to influence populations. Moscow seeks to create wedges that reduce trust and confidence in democratic processes, degrade democratization efforts, weaken U.S. partnerships with European allies, undermine Western sanctions, encourage anti-U.S. political views, and counter efforts to bring Ukraine and other former Soviet states into European institutions.”

In July 2018, the FBI arrested Butina on charges of illegally operating as an unregistered foreign agent. After serving 15 months in prison, Butina was deported to Russia in 2019.

Iraq-born Hawazen Sameer Mothafar immigrated to the United States, probably during a refugee resettlement spike in 2009, and settled in the Portland, Ore., suburb of Troutdale. He became a lawful permanent resident on October 28, 2010, and filed an application for naturalized citizenship in May 2016, passing his naturalization exam in February 2018, according to a later civil lawsuit against the U.S. government.

Mothafar was awaiting final citizenship adjudication in November 2020 when federal prosecutors indicted and arrested him on terrorism charges related to at least five years of managing digital incitement propaganda publishing operations, extremist chat rooms, and email accounts for senior leaders of the ISIS terrorist organization. An FBI investigation, and apparently not national security vetting by USCIS on Mothafar's citizenship application, is what uncovered his support for ISIS. That support included his production of the pro-ISIS media site Al Dura'a al Sunni ("The Sunni Shield", that published 32 issues of the ISIS newspaper Al-Anfal that included articles with titles such as "Effective Stabbing Techniques" and "How Does a Detonator Work".

In their indictment, federal prosecutors alleged that FBI investigators traced Mothafar’s support to as early as 2014 and “no later than February 2015”, which would indicate that USCIS adjudicators were unaware of nearly three years of his illicit activity in support of ISIS, which included setting up Facebook pages for known foreign terrorist leaders. For the subsequent years until his arrest, when Mothafar allegedly edited and produced Al Anfal, he was receiving orders directly from the ISIS central media office, known as Diwan, the indictment states. The indictment accuses him of conducting research for ISIS on how to fly a drone carrying an object for another arrested official, and regularly encouraged terror attacks. Two government charges of conspiracy to materially support terrorism remained unadjudicated as of December 2022 as the Department of Justice investigation continued overseas.

Mothafar's illicit activity apparently came some years after he applied for refugee status and likely entered the United States in about 2009 and received Legal Permanent Residence in 2010. But although immigration-related security vetting for those benefits occurred prior to his ISIS activities, the vetting process for his May 2016 citizenship application apparently missed his intense, prominent social media activity for three years and about seven months after he began engaging in it, until he came to FBI attention in November 2019. Court filings indicate that the terrorism lead was generated during a November 25, 2019, interview in Iraq with captured ISIS propaganda operations leader Yasir al Anzi, a government motion to depose Al Anzi for Mothafar's trial indicates.

In that Iraqi prison interview, Al Anzi disclosed details about an "American volunteer" who, in 2014, was among “strong [ISIS] supporters” in the United States, who was in a wheelchair and went by the name Abu Ubayda al-Rifai, a name used by the wheelchair-bound Mothafar.

“The FBI has confirmed that Abu Ubayda al-Rifai is the defendant,” the government said in its motion to depose the Iraqi prisoner.

It is reasonable to judge, given the extent to which Mothafar was radicalized by 2014 and operating inside the U.S. that at least the earlier vetting for refugee status and a Legal Permanent Residency in 2009 or 2010 would have found little. 

But he was well involved by the time he filed a citizenship application in 2016 and vetting cleared him enough to take his citizenship exam in 2018. Mothafar was thus able to remain free to continue operating ISIS’s digital communications and email accounts until his November 2020 FBI arrest. It was the FBI investigation that ultimately held up the Mothafar application’s adjudication. (The FBI is able to request that USCIS delay adjudications on applicants who are investigative targets, under a policy known as the Controlled Application Review and Resolution Program.)

This timing indicates that security vetting for the citizenship application, which is supposed to be concluded within six months, failed by not delving into Mothafar's social media activity or deeply interviewing him or associates.

Oregon’s FBI Special Agent in Charge Renn Cannon was quoted as saying that Mothafar’s alleged online propaganda aimed to incite lone actor operators in the United States and was especially dangerous.

“When it comes to cases like this one,” Cannon stated, “a computer and keyboard can be powerful weapons against the enemies of the Islamic State.”

For example, a month after filing for citizenship, Mothafar is alleged to have shared 70 images of explosives and western cities, telling Sunni Shield members, “The images of destroyed infidel cities will be useful,” the indictment said. He continued inciting to violence online throughout 2019 and well into 2020, and continued supporting ISIS officials overseas until the day of his arrest. These are activities that authorities undoubtedly would have prevented with an arrest had they known of them.

Prosecution was pending as of January 2023.

Iraq-born Chasib Hafedh Saadoon Al Fawadi, his wife, and two minor sons applied for U.S. refugee status in Turkey and, after six months of ostensible security vetting, secured it right after a September 2015 personal interview with a U.S. Citizenship and Immigration Services officer in Istanbul, required as a reform following the 9/11 attacks. Al Fawadi claimed he couldn’t return to Iraq because the Iran-backed extremist Shiite militia group Asa’ib Ahl al-Haq (AAH) had tried to force him to participate in kidnappings.

The Al Fawadi family entered the United States in January 2016, settling initially in San Antonio, Texas, and later moving to Syracuse, N.Y., and, the requisite one year later for refugees, applied for lawful permanent resident green cards. But many months of prospective security vetting for his green card would not lead to revelations that Al Fawadi had served a virulently anti-American, Iran-backed paramilitary insurgent organization during the years when it mounted thousands of attacks on American soldiers in Iraq.

A 2020 FBI and ICE counterterrorism investigation later showed the 35-year-old Al Fawadi easily lied his way through both screenings despite his offering the clue that the AAH paramilitary militia had communicated with him about conducting violent criminal activity. The reality was that, since at least the age of 16, Al Fawadi had served AAH as an armed, trained, and uniformed insurgent right up until he applied for refugee status, and that he participated in the Iranian group’s extensive sabotage, kidnapping, political assassination, hijacking, and terrorism operations, according to court records and government press releases. Iran’s Islamic Revolutionary Guard Corps Quds Force, an entity designated by the United States as a terrorist organization, extensively funded and trained AAH, which claimed responsibility for 6,000 attacks against American and coalition forces since 2006, according to a State Department release announcing that AAH had been designated a terrorist group in 2020.

The FBI learned that Al Fawadi fought with and traveled far on behalf of AAH while it was attacking American troops. He fought in Syria on behalf of the government during the civil war with Sunni terrorist groups, spent time in Jordan, and traveled to Iran itself during his years with the group. During their investigation, the FBI found numerous photographs of Al Fawadi, dating to 2012 and 2013, with his AAH unit, wearing the AAH uniform, posing with a shoulder-fired rocket grenade launcher, receiving an award from the terrorist group’s leader Qais al-Khazali, manning a heavy machine gun in the bed of a pickup truck, and of him with his unit in front of the Damascus, Syria, international airport carrying a semi-automatic assault rifle over a shoulder, and in front of the Fatimah Masumeh Shrine in Qom, Iran.

How Al Fawadi was able to conceal all of this photographic evidence and personal history from USCIS refugee adjudicators in Turkey and later in the United States remains unclear. But undoubtedly his name would have been known to Iraqi or American intelligence services, which might have been detected with some checks. But even if Al Fawadi’s name was not known to allied intelligence services, his bogus claim that AAH members had communicated with him about kidnapping operations almost certainly should have triggered in-depth interviews of family and associates to turn up discrepancies in Al Fawadi’s proffered persecution narrative. And indeed, according to a government motion to keep Al Fawadi detained, federal prosecutors in New York pointed out that Al Fawadi told American screeners in Turkey that he had never traveled beyond Iraq and Turkey but slipped up a few years later in 2019 and told USCIS that he had traveled to Jordan, a significant discrepancy that should have triggered intense investigation, a denial of his LPR application, and deportation.

The court records do not indicate whether USCIS ever granted Al Fawadi’s lawful permanent resident green card, perhaps because of intervening domestic assault charges. But the records do make clear that security vetting by USCIS was not what uncovered his anti-American insurgency past. The FBI did not arrest him until October 2020 following a counterterrorism investigation.

“Based on discussions with an official from United States Citizenship and Immigration Services … it is government counsel’s understanding that Al Fawadi’s false statements about involvement in Asa’ib Ahl al-Haq and travel to Syria and Iran are alone sufficient for Al Fawadi’s application for lawful permanent resident status to be denied and for him to be deported from the United States, all without regard to the outcome of this criminal prosecution,” federal prosecutors wrote in their motion to detain.

Although its outcome remains unclear, the 2017-2019 processing of Al Fawadi’s LPR application raises further questions as to why it lingered for so long and allowed Al Fawadi to pose a threat to his wife and American citizens.

Less than a year after settling in San Antonio as refugees, local police on November 20, 2016, arrested Al Fawadi for committing an aggravated assault with a deadly weapon (a knife) against his wife, who was pregnant with their third child, a government memorandum recounted. She told police this act was part of a long pattern of physical abuse but later declined to press charges. In April 2017, his wife reported to local police in Syracuse that Al Fawadi had kidnapped her for several days, beat her and held a knife to her throat again. A few months later, Al Fawadi applied for his green card, which was not denied then or possibly ever despite its pending for two years.

Instead, USCIS reviewers seem to have found no reason to deny it even after an April 9, 2019, interview with Al Fawadi, providing the opportunity for him to continue living inside the United States – and to allegedly abuse his wife. Twenty days after that USCIS interview, on April 29, 2019, local police arrested Al Fawadi and charged him with the first-degree rape of his wife, after which he repeatedly violated court protection orders to not contact her. USCIS officers would interview Al Fawadi about his application six months later, showing the application was still not denied and that his paramilitary past remained undiscovered during those months of prospective vetting. Any government knowledge of his AAH service would remain buried for many more months, until, evidently, Al Fawadi’s estranged wife had him arrested for rape and probably tipped off investigators.

Prosecutors believed that allowing Al Fawadi to live inside the United States posed a violent threat to all Americans, mainly because his AAH group had publicly vowed revenge operations in the United States for President Donald Trump’s January 3, 2020, drone strike assassination of Quds Force commander Qasem Soleimani in Iraq. Prosecutors wrote in their motion to detain that:

“In short, Al Fawadi was an active member of a paramilitary organization whose mission and activities posed a sufficient threat to have it designated by the State Department as a foreign terrorist organization. Although this designation is recent, it is based on activities that occurred when Al Fawadi was actively involved in the organization. When given an opportunity to acknowledge his participation and its nature, Al Fawadi instead responded with implausible falsehoods. It is reasonable to conclude from this evidence that Al Fawadi remains both unrepentant and committed to the violent objectives of this terrorist group.”

In September 2020, federal investigators arrested Al Fawadi on a three-count indictment alleging that he made false statements in the immigration applications. He was already in state custody on charges that he raped his wife, according to a government motion that Al Fawadi posed a flight risk and should be detained. In September 2021, Al Fawadi pleaded guilty to lying to USCIS on his refugee and LPR applications. Sentencing was pending as of November 2021, although the plea agreement provides for his deportation after his federal sentence and also after his New York rape case is adjudicated.

A 2019 federal indictment accused Yemeni student Gaafar Muhammed Ebrahim Al-Wazer in Pennsylvania of lying to the FBI about his experience fighting with the Iran-backed, anti-America Houthi rebels and that he harbored such fervent hatreds that his Facebook page wished "death to all Americans, especially Jews'' and vowed he would stay on the path of jihad.

Al-Wazer successfully covered up his involvement with the Houthi rebels for his 2014 interview with U.S. consular officers in Yemen, and in two interviews with U.S. Citizenship and Immigration Services agents for Temporary Protected Status in 2016 and in 2017, despite social media postings by then indicating Houthi rebel support and involvement. He received TPS status after both vetting opportunities and was not discovered until 2019, when a tipster provided federal agents with social media postings by Al-Wazer, who checked the “no” box or answered in the negative when asked if he had ever held membership in a militia, had training, or had sided with any armed faction in Yemen’s conflict.

“The defendant knew that this answer was false because he in fact did support one of the sides in the conflict in Yemen, as evidenced by his social media posts and communications,” a government sentencing memorandum stated.

During warfare in Saana, Yemen, involving an offensive by Houthi rebels in October 2014, Al-Wazer applied online for an F-1 nonimmigrant student visa to study English for nine months in Austin, Texas. He swore on the application that he had no militia experience and belonged to no particular tribe. He was granted approval on the same day as the application and entered the United States two months later. A year after entering, in late 2015, Al-Wazer applied to USCIS for Temporary Protected Status  due to the escalating civil war in Yemen. It, too, was almost summarily granted, as was a renewal in 2018.

From 2016 forward, the FBI was pursuing a terrorism investigation targeting Al-Wazer after he posted Facebook photos showing him as an armed member of the Houthi rebel insurgency. He was charged with lying to the immigration officers who had previously interviewed him. The criminal complaint describes falsehoods on his applications for the non-immigrant visa and for Temporary Protected Status. In March 2021, he waived prosecution by indictment and pleaded guilty to an Information that charged him with lying to federal agents.

Iraqi national Omar Ameen entered the United States on a refugee visa in 2014. He was living and working as an Uber driver in Sacramento in 2018, several years after his resettlement from the war zones of Iraq, when FBI agents arrested him in his apartment. The agents took him in on a rare extradition request by the Iraqi government that alleged that Ameen served as an ISIS commander in occupied northern Iraq and that on June 22, 2014, he murdered a police officer while leading his unit in Rawah, Iraq.

President Donald Trump’s administration heralded the Ameen case as an example of poor national security vetting for Iraqi refugees, arguing for a halt to the immigration program that brought in Ameen and thousands of other Iraqis. In April 2021, however, that specific Iraqi murder and extradition case fell apart when a California federal judge ruled that Ameen could not plausibly have murdered the Iraqi officer.

But the Ameen case still held up as an example of failed security vetting. In May 2021, President Joe Biden’s Department of Homeland Security (ICE) re-arrested Ameen for deportation based on other evidence that, while Ameen may not have murdered that particular police officer, nine witnesses told the FBI he still operated as an ISIS commander and committed other acts of terror from 2009 through 2014 that would have disqualified him from U.S. refugee status and U.S. entry.

Ameen obtained his refugee status in 2014 after presumed USCIS security vetting and entered the United States that November, settling in California. The security vetting apparently did not check Iraqi government reporting that Ameen had commanded an ISIS unit for at least five years, including the year in which he applied for U.S. refugee status.

In refusing to release Ameen, the Biden Department of Homeland Security cited intelligence that the Iraqi government provided – and also independent FBI interviews – alleging that Ameed was, at the time, a terrorist commander who had engaged in acts of terrorism, according to the Washington Post in July 2021. During a hearing on his further detention, former FBI special agent William Denton, who had initially interrogated Ameen about the police officer murder, said Ameen lied or misled officials during the refugee application process, which took place in Turkey, because he did not acknowledge his or his relatives’ alleged involvement in terrorism.

“We concluded that … Omar Ameed personally engaged in numerous acts of terrorism in and around the Rawah area, starting from 2009 up until the latest potentially in 2014,” Agent Denton said. “Mr. Ameen knew and had associations with a terrorist organization that he did not disclose.”

As of May 2022, the federal government added three new charges to Ameen's case, accusing him of lying about his father being shot to death, his brother being kidnapped by masked men and that he had no information about his brother after the purported kidnapping. Ameed was challenging the veracity of government witnesses and the Iraqi government, who told FBI investigators of his alleged involvements with ISIS. He has claimed he was never part of ISIS or involved in terrorist acts.

His attorneys claimed he was a “properly vetted and admitted” refugee. No new information was available about the case in the Spring of 2023.

Pakistani citizen Tashfeen Malik entered the United States in about May 2014 on a K-1 fiance visa to marry American citizen Syed Rizwan Farook. They were married in August 2014, then in December 2015 conducted an attack together that killed 14 people in San Bernardino, Calif. Both were eventually killed after a running gun battle with police.

Malik was born in Pakistan and moved with her family to Saudi Arabia when she was a child. State Department officials would have asked how Malik and Farook met; how they decided to marry; and some details about Farook, as a U.S. citizen. Malik would have needed to detail for U.S. Citizenship and Immigration Services and State Department officials every country to which she had traveled over the last five years and if she was tied to terrorism or its ideology. But none of the checks found her prolific social media postings, which indicated an extreme hatred for the United States and support for violent jihadist acts.

According to a Los Angeles Times report:

It takes three to five months for United States Citizenship and Immigration Services to review and approve a petition, at which point the petition goes to the State Department. A U.S. Embassy or consulate conducts a medical exam, checks police records and interviews the foreign applicant, [immigration attorney Paul] Herzog said.

“It’s a very detailed petition,” said Los Angeles immigration attorney Roman P. Mosqueda. “If you’re getting married in a church, you have to show proof of getting a church date for the wedding, a date for the restaurant for the reception.... It’s very strict.”

The paper also quoted State Department spokesman Mark Toner during a news briefing after the attack that "Since 9/11, [any visa application will] involve multiple layers of vetting, with multiple agencies putting folks through various systems, where we watch individuals, what their affiliations are, whether they're on any kind of watch lists".

Malik reportedly passed three separate terrorism background checks for her fiance visa by the USCIS and then the State Department, which were responsible, the New York Times reported. But all of those missed her prolific “online zealotry” for jihad before she arrived in the United States, mainly because security screening routines, even for Pakistanis who grew up in Saudi Arabia, “do not routinely conduct social media searches during the visa process”, the newspaper reported.

And so that key evidence was missed some 15 years after the 9/11 hijackers, most of whom were citizens of Saudi Arabia, struck in New York and Washington, D.C.

“Had the authorities found the messages years ago, they might have kept her out of the country,” the Times reported. “But their recent discovery exposed a significant — and perhaps inevitable — shortcoming in how foreigners are screened when they enter the United States, particularly as people everywhere talk more and disclose more about themselves online.”

“Despite a tremendous electronic intelligence-gathering apparatus that captures phone calls and emails from around the world, it remains impossible to conduct an exhaustive investigation for each of the tens of millions of people who are cleared each year to come to this country to work, visit or live.” the article continued.

The 27-year-old Chinese national Ji Chaoqun arrived in Chicago on an F-1 student visa in 2013 to study electrical engineering at the Illinois Institute of Technology. He eventually enlisted in the U.S. Army Reserve under Military Accessions Vital to the National Interest (MAVNI), a program that allows certain nonimmigrants to enlist and gain immigrant status and eventual citizenship. But long before Chaoqun received the F-1 student visa, he was clandestinely feeding sensitive U.S. defense information to Chinese intelligence services, prosecutors allege in a 2018 indictment. This circumstance could have been uncovered in November 2016, during at least the second of three U.S. security vetting opportunities associated with Chaoqun’s applications to stay in the United States. Catching him at these points would have shaved up to two years from the time he was able to steal defense-related technology research.

State Department officers responsible for initial visa security vetting on the F-1 application in China would not be expected to uncover clandestine espionage activity with ordinary checks, since spies are trained to avoid detection, though it is possible checks with U.S. and allied counter-intelligence services might well have flagged Chaoqun as the Chinese agent he was.

Though such a discovery would qualify as a long shot, American authorities would have had a good chance to discover Chaoqun’s true mission when he asserted in a November 2016 Optional Practical Training (OPT) application – a post-university type of temporary work authorization – that he was going to work for a company that never actually hired him.

Vetting of OPT applications are not routine, though it could and arguably should happen for certain nationalities.

Had USCIS reviewers in Illinois completed basic verification checks on the OPT application, they likely would have discovered that he lied about having this job opportunity. That discovery would almost certainly have ended Chaoqun’s depredations inside the United States and may well also have unraveled his espionage mission earlier than it was, as well.

In 2018, federal authorities eventually did find out about the espionage and charged Chaoqun with violating the Foreign Agents Registration Act, which requires individuals working for foreign governments to register with the U.S. attorney general.

The investigation showed the Chinese agent worked undercover from at least August 28, 2013, to or about September 2018 providing information to Chinese intelligence such as background checks on eight American citizens, including U.S. defense contractors.

Because the 2016 OPT fraud initially went undiscovered, Chaoqun instead was free to join the U.S. Army Reserves under MAVNI.

The intensive MAVNI security vetting process, done by the Department of Defense, likewise missed the OPT fraud and his intelligence work, a second reasonable opportunity to discover Chaoqun’s national security depredations. The FBI caught on to him from other related investigations.

In September 2018, the FBI arrested Chaoqun and charged him with acting as an unregistered foreign agent, wire fraud, and making false statements to government agencies. In February 2023, a federal judge sentenced Chaoqun to 96 months in prison for conspiracy to defraud the United States, lying to federal officials, and impersonating agents of foreign governments.